CWE-692
Incomplete Denylist to Cross-Site Scripting
Draft
2008-04-11
00h00 +00:00
00h00 +00:00
2025-12-11
00h00 +00:00
00h00 +00:00
Benachrichtigungen für ein CWE
Bleiben Sie über alle Änderungen zu einem bestimmten CWE informiert.
Name: Incomplete Denylist to Cross-Site Scripting
The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
CWE-Beschreibung
While XSS might seem simple to prevent, web browsers vary so widely in how they parse web pages, that a denylist cannot keep track of all the variations. The "XSS Cheat Sheet" [REF-714] contains a large number of attacks that are intended to bypass incomplete denylists.
Allgemeine Informationen
Einführungsmodi
ImplementationAnwendbare Plattformen
Sprache
Class: Not Language-Specific (Undetermined)Technologien
Class: Web Based (Often)Name: Web Server (Often)
Häufige Konsequenzen
| Bereich | Auswirkung | Wahrscheinlichkeit |
|---|---|---|
| Confidentiality Integrity Availability | Execute Unauthorized Code or Commands |
Beobachtete Beispiele
| Referenzen | Beschreibung |
|---|---|
CVE-2007-5727 | Denylist only removes |